Last week I decided to give OpenDNS a shot. It seemed like a good alternative to the DNS server of my ISP (not that my service provider has proved itself untrustworthy on that score, but I decided to be rather safe than sorry).

Specifically, what I wanted to avoid was a scenario that has played out far too often among ISPs, called DNS Hijacking.

Particularly the more infamous providers (including Comcast and Verizon) have made bad headlines in the past few years for doing this. It goes like this:

When your computer looks up a domain like "invalid.asdfghjklomnbv.tld", the DNS server is supposed to return a clear signal that the lookup failed, which is called "NXDOMAIN". That lets the client decide what to do next - maybe try another nameserver, maybe redirect to Google, maybe display an error message or log a failed connection attempt. The beauty of this is that the NXDOMAIN is part of the DNS protocol and therefore independent of what kind of computer you actually connect with. It might be a server for IRC, SMTP, a web or a news server. The client will know what to do in case of a failed lookup.

The DNS server doesn't actually have to do that, of course. As in all other matters, you have to trust it to give you accurate information.

What some ISPs have realized is that they can drive massive traffic to advertisers by hijacking their customers' failed domain lookups. In effect, that means you never get a normal "domain does not exist" message. Instead, the DNS server lies to you and says the domain resolves to its very own ad-server. You connect to the server, get some vaguely related search results. It's annoying, it's a violation of the DNS protocol, it breaks non-web clients, and is one of the things I hoped to avoid with an alternative DNS service.

Imagine my chagrin when I entered a non-existent domain while using OpenDNS, and saw this.

What is worse, if I connect to a bad mail or IRC server, I'm stuck waiting while my client tries to connect to port 6667 or 25 on the OpenDNS server, which times out.

Long story short, I'm using OpenNIC instead now, and it works like a charm. Amazingly, they have also managed to restrain themselves from trying to hijack my domain lookups. Moral: Not everything that has "Open" in the name is actually useful or reliable (though that was probably clear since the farce Microsoft made of the International Standards Organization with Office Open XML).